2017 ORS
746.620¹

Notice of insurance information practices

• exceptions

• rules

(1) A licensee must provide a clear and conspicuous notice of personal information practices to individuals in connection with insurance transactions under the following circumstances and at the following times:

(a) Except as provided in this paragraph, to a consumer who becomes a customer of the licensee, not later than the date that the licensee establishes a continuing relationship under which the licensee provides one or more insurance products or services to the consumer that are to be used primarily for personal, family or household purposes. A licensee may provide the notice within a reasonable time after the date the licensee establishes a customer relationship if:

(A) Establishing the customer relationship is not at the customer’s election; or

(B) Providing notice not later than the date that the licensee establishes a customer relationship would substantially delay the customer’s transaction and the customer agrees to receive the notice at a later time.

(2)(a) Except as provided in paragraph (b) of this subsection, a licensee shall provide a clear and conspicuous notice to a customer that accurately reflects the licensee’s privacy policies and practices not less than annually during the continuation of the relationship described in subsection (1)(a) of this section. For the purpose of this subsection, a notice is given annually if the notice is given at least once in any period of 12 consecutive months during which the relationship exists. A licensee may define the period of 12 consecutive months, but the licensee must apply the period to the customer on a consistent basis.

(b) A licensee need not provide the notice described in paragraph (a) of this subsection each year if the licensee provides personal information to an unaffiliated third party only in accordance with ORS 746.665 (Limitations and conditions on disclosure of certain information) and does not change the policies and practices related to disclosing personal information about which the licensee last notified customers in accordance with this section. If the licensee changes the licensee’s privacy policies and practices, the licensee shall notify customers in accordance with this section.

(3) The privacy notice required by subsections (1) and (2) of this section must be in writing and must be clear and conspicuous. The notice may be provided in electronic form if the recipient agrees. In addition to any other personal information the licensee wishes to provide, the notice must include the following items of personal information that apply to the licensee and to the individuals to whom the licensee sends the notice:

(a) The categories of personal information that the licensee collects.

(b) The categories of personal information that the licensee discloses.

(d) The categories of personal information about former customers of the licensee that the licensee discloses and the categories of affiliates and nonaffiliated third parties to whom the licensee discloses personal information about the licensee’s former customers, other than persons to whom the licensee discloses personal information under ORS 746.665 (Limitations and conditions on disclosure of certain information).

(g) Any disclosure that the licensee makes under section 603(d)(2)(A)(iii) of the federal Fair Credit Reporting Act (15 U.S.C. 1681a(d)(2)(A)(iii)) regarding the ability to opt out of disclosures of personal information among affiliates.

(h) The policies and practices of the licensee with respect to protecting the confidentiality and security of personal information.

(i) Any disclosure that the licensee makes under subsection (4) of this section.

(4) If a licensee discloses personal information as authorized under ORS 746.665 (Limitations and conditions on disclosure of certain information), the licensee is not required to list those exceptions in the privacy notices required by this section. When describing the categories of parties to whom disclosure is made, the licensee shall state only that the licensee makes disclosures to other affiliated parties or nonaffiliated third parties, as applicable, as authorized by law.

(5) In lieu of the notice required in subsection (3) of this section, the licensee may provide to a consumer an abbreviated notice, in writing or in electronic form if the consumer agrees, informing the consumer that:

(a) Personal information may be collected from persons other than the consumer proposed for coverage;

(b) Such information as well as other personal or privileged information subsequently collected by the licensee may in certain circumstances be disclosed to third parties without authorization;

(c) A right of access and correction exists with respect to all personal information collected; and

(d) The licensee shall provide the notice prescribed in subsection (3) of this section to the consumer upon request.

(a) Facilitate compliance with requirements in federal law and the laws of other states that establish protections of nonpublic personal information; and

(b) Establish separate and discrete requirements relating to the privacy notice and the contents and delivery of the privacy notice for customers and consumers, so that the requirements provide reasonable notice and facilitate compliance with requirements in federal law and in the laws of other states.

(7) The director shall determine by rule:

(a) When a privacy notice must be provided to a certificate holder or beneficiary of a group policy and to a third-party claimant.

(b) When the obligation to provide annual notice ceases.

(c) Requirements for revision of the notice by a licensee.

(8) An insurance producer is not subject to the requirements of this section when the insurer on whose behalf the insurance producer acts otherwise complies with the requirements of this section and the insurance producer does not disclose any personal information to any person other than the insurer or its affiliate, or as otherwise authorized by law.

(9) A licensee may provide a joint notice from the licensee and one or more of the licensee’s affiliates or other financial institutions, as identified in the notice, as long as the notice is accurate with respect to the licensee and the other institutions. A licensee may also provide a notice on behalf of a financial institution.

(10) The obligations imposed by this section upon a licensee may be satisfied by another licensee authorized to act on behalf of the first licensee.

2 OregonLaws.org contains the con­tents of Volume 21 of the ORS,
inserted along­side the per­tin­ent statutes.
See the preface to the ORS An­no­ta­tions for more information.

3 OregonLaws.org assembles these lists by analyzing references between Sections. Each
listed item refers back to the current Section in its own text. The result reveals
relationships in the code that may not have otherwise been apparent.

Stay Connected

Committed to Public Service

We will always provide free access to the current law.
In addition, we provide special support
for non-profit, educational, and government users.
Through social entre­pre­neurship,
we’re lowering the cost of legal services and increasing
citizen access.